homelab/terraform/bootstrap-certificates.tf

resource "kubernetes_manifest" "selfsigned_bootstrap" {
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "ClusterIssuer"
    metadata = {
      name = "selfsigned-bootstrap"
    }
    spec = {
      selfSigned = {}
    }
  }

  field_manager {
    name = "terraform"
  }
}

resource "kubernetes_manifest" "homelab_ca_cert" {
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "Certificate"
    metadata = {
      name      = "homelab-ca"
      namespace = kubernetes_namespace.namespaces["cert-manager"].metadata[0].name
    }
    spec = {
      secretName = "homelab-ca-secret"
      commonName = "homelab-ca"
      isCA       = true
      issuerRef = {
        name = "selfsigned-bootstrap"
        kind = "ClusterIssuer"
      }
      duration    = "87600h"
      renewBefore = "720h"
      privateKey = {
        algorithm = "ECDSA"
        size      = 256
      }
    }
  }

  field_manager {
    name = "terraform"
  }

  depends_on = [
    kubernetes_manifest.selfsigned_bootstrap
  ]
}

resource "kubernetes_manifest" "homelab_ca_issuer" {
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "ClusterIssuer"
    metadata = {
      name = "homelab-ca"
    }
    spec = {
      ca = {
        secretName = "homelab-ca-secret"
      }
    }
  }

  field_manager {
    name = "terraform"
  }

  depends_on = [
    kubernetes_manifest.homelab_ca_cert
  ]
}

resource "kubernetes_manifest" "wildcard_cert" {
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "Certificate"
    metadata = {
      name      = "homelab-tls"
      namespace = kubernetes_namespace.namespaces["ingress-nginx"].metadata[0].name
    }
    spec = {
      secretName = "homelab-tls"
      commonName = "*.${var.cluster_domain}"
      dnsNames   = ["*.${var.cluster_domain}"]
      issuerRef = {
        name = "homelab-ca"
        kind = "ClusterIssuer"
      }
      duration    = "2160h"
      renewBefore = "720h"
    }
  }

  field_manager {
    name = "terraform"
  }

  depends_on = [
    kubernetes_manifest.homelab_ca_issuer,
    kubernetes_namespace.namespaces
  ]
}